Improper Verification of Cryptographic Signature
The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability.
Info
- Published
- June 19, 2023
- Modified
- June 19, 2023
- CAPECs
- < none >
- CWEs
- 347
- Keywords
- crypto, historical
- Aliases
- CVE-2022-31053
- Related
- GHSA-75rw-34q6-72cr
- References
- [REPORT] https://eprint.iacr.org/2020/1484
- [ADVISORY] https://github.com/biscuit-auth/biscuit/security/advisories/GHSA-75rw-34q6-72cr
Affected
biscuit-haskell
- CVSS
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Versions
>=0.1.0.0 && <0.2.0.0- Declarations
- < none >